Encrypt Online
Theme

JWK Thumbprint Calculator

Hash the canonical public key fields and see exactly what counted

Safety note: RFC 7638 thumbprints are calculated from public JWK members only. If you paste a private JWK, the page ignores private members and tells you exactly what was left out.
Calculate an RFC 7638 JWK thumbprintPick one key from a JWK or JWKS, review the canonical JSON that gets hashed, and copy the stable Base64URL identifier
kid helps choose one key from a JWKS. It is not part of the thumbprint and does not affect the final digest.
Leave this blank for a single JWK. Add it only when the input is a multi-key JWKS.
What a JWK Thumbprint Is

A JWK thumbprint is a SHA-256 digest of a canonical JSON representation of the public key members defined by RFC 7638. It is stable for the same public key even when publishers change extra metadata like kid, alg, or use.

Calculate and Review
  1. Paste a single JWK or a JWKS document.
  2. Add kid if you need to choose one key from a larger set.
  3. Click Calculate thumbprint and review the canonical JSON preview.
  4. Copy the Base64URL value when you need an RFC 7638-style identifier.
Why It Differs from kid

kid is a publisher-chosen label. A thumbprint is derived from the public key itself. Two JWKs can share the same key material and therefore the same thumbprint even when their kid values differ.

Reproducible Evidence

This tool has a versioned public record with three synthetic cases. Each expected result is recomputed from the production diagnostic core during the release check; the record also publishes fixture and source SHA-256 digests.

  • JWK-RSA-THUMBPRINT-VALID-001valid
    A synthetic RSA JWK produces the fixed canonical JSON and SHA-256 thumbprint.
  • JWK-METADATA-INVARIANT-002mismatch
    Publisher metadata changes while the RSA public key members stay the same.
    Expected code: METADATA_IGNORED_BY_RFC7638.
  • JWK-RSA-MISSING-MODULUS-003malformed
    An RSA JWK omits the required modulus member n.
    Expected code: INVALID_JWK.

Open the complete citation evidence record (JSON)

Implementation source-sha256:31fc99b47da53d11; verified 2026-08-05. Read the record's scope before citing a result; structural or cryptographic evidence is not automatically an identity or trust verdict.

FAQ
Do private JWK members change the thumbprint?

No. This page ignores private members and hashes only the RFC 7638 public-member set for the key type.

Why show the canonical JSON?

Because the normalization rules are the whole point. The JSON preview shows the exact member set and order that got hashed.

Is the hashing local-only?

Yes. Select a JWK, normalize its public members, and calculate the RFC-compatible SHA-256 thumbprint.